Publikationen

27.01.2020

Wie Unternehmen verantwortungsvoll mit Daten und Plattformen umgehen

Leitlinien der deutschen Elektroindustrie

Mensch person Daten Datenschutz Cybersicherheit PBD Plattform Cloud Internet

Vorbemerkung

Mit der Digitalisierung findet ein grundlegender Strukturwandel in Wirtschaft und Gesellschaft statt. Die deutsche Elektroindustrie, die mit ihren Produkten und Lösungen Bindeglied zwischen analoger und digitaler Welt ist, gestaltet diesen Wandel aktiv mit.

Die Digitalisierung der Wirtschaft ist die Voraussetzung, um stabil und nachhaltig zu wachsen, sie schafft einen Mehrwert für die Gesellschaft und trägt zur Lösung globaler Herausforderungen bei. Digitalwirtschaft im industriellen Sektor bedeutet, die Konnektivität sowohl von einzelnen Produkten als auch ganzer Infrastrukturen herzustellen, die über Unternehmen hinausgehen und Lieferanten und Kunden einschließen können.

Der „Rohstoff“ der digitalisierten Wirtschaft sind Daten. Heute nutzen Unternehmen der Elektroindustrie diese vor allem dafür, bestehende Geschäftsmodelle und Prozesse zu optimieren. Zunehmend jedoch dienen die Daten auch der Entwicklung neuer Geschäftsmodelle. Dadurch entstehen neue Wertschöpfungsstrukturen und Partnernetzwerke.

Dabei kommt digitalen Plattformen auch im industriellen Kontext ein besonders hoher Stellenwert zu. Sie sind die Drehscheiben, auf denen Marktteilnehmer Daten nutzen und austauschen. Kleinen und mittleren Unternehmen (KMU) und Start-ups bieten offene Plattformen eine Chance, sich in die neu entstehenden Ökosysteme einzubringen. Aber die Nutzung und Verarbeitung von Daten und der Betrieb von Plattformen können auch zu Missbrauch und Konflikten führen.

Um das Potenzial von Daten und Plattformen nutzen zu können, ist neben klaren rechtlichen Regelungen vor allem auch der Aufbau von Vertrauen erforderlich. Dafür ist ein gemeinsames Wertefundament nötig, das im praktischen Handeln konsequent umgesetzt wird.

In Deutschland und Europa steht immer der Mensch im Mittelpunkt und mit ihm die aus dem Schutz der Menschenwürde abgeleiteten Grundrechte. Hierbei kommen im Hinblick auf Daten und Plattformen vor allem dem Schutz der Privatsphäre und dem Schutz personenbezogener Daten besondere Bedeutung zu. Zu unserem Wertefundament zählen zudem die Regeln der sozialen Marktwirtschaft, die einen fairen Wettbewerb definieren, sowie die Umsetzung der globalen Nachhaltigkeitsziele der Vereinten Nationen. Hierin sehen wir das Wertefundament der Elektroindustrie, das unser Handeln leitet und das wir im internationalen Wettbewerb zur Geltung bringen.

Die vorliegenden Leitlinien konkretisieren auf Basis dieses Wertefundaments, woran sich die Elektroindustrie bei der Nutzung von Daten und bei der Gestaltung von Plattformen orientiert.

Wir verstehen die Formulierung der Leitlinien als kontinuierlichen Prozess und als Gesprächsangebot. Auf Grundlage der Leitlinien werden wir uns aktiv in den Dialog über die Rahmenbedingungen der Digitalwirtschaft einbringen. Dass die Leitlinien praktisch umgesetzt werden, verdeutlichen die Beispiele aus der Unternehmenspraxis von ZVEI-Mitgliedsunternehmen im Anhang.

Mit Fallbeispielen

Zehn Leitlinien zum verantwortungsvollen Umgang mit Daten und Plattformen

1. Personal data is worth of particular protection

Companies in Germany's electrical industry consider the individual's self-determination of their own data a central basis for the digital economy. We see the requirements for data protection set out in the General Data Protection Regulation (GDPR) as a competitive advantage in the global competition.

Case studies from practice

Case study 1: Befund24

Befund24 has set up a marketplace for the mediation of remote diagnosis services in the health sector. To protect personal data, the platform operates according to the basic principle of "privacy by design and by default" in accordance with Article 25 of the General Data Protection Regulation (GDPR). The development of the Befund24 marketplace solution is based on the Siemens Healthineers cybersecurity development process, which includes a threat and risk analysis (TRA), the implementation of security standards and security checks. In addition, external penetration tests are carried out regularly. Patient data is always encrypted in the Befund24 cloud. Patients can assert any claims for information against the hospital or the creator of the findings report.

Further information

https://www.befund24.de/

Case study 2: Bundesdruckerei

In future, Bundesdruckerei will offer data trustee services in the healthcare sector (pseudonymisation, authorisation and consent management) as a service via a digital platform. With the help of a trusted third party, personal data and pseudonyms can be managed securely. Only pseudonyms are assigned to the user data. By means of an authorization management the data provider can decide who receives which data for inspection or revoke this authorization.

Further information

https://www.bundesdruckerei.de/de/Themen-Trends/Magazin/Der-Datentreuhaender-als-neutrale-Schutzinstanz

Case study 3: Eaton

Eaton has introduced a uniform, companywide policy for personal data protection. Since the Group operates globally, and there is no robust international legislation on personal data protection, Eaton has introduced a policy that applies to all sites and subsidiaries worldwide and is based on the General Data Protection Regulation (GDPR). This is intended to ensure that the personal data of customers and employees worldwide is handled in accordance with the highest security standards currently available.

Further information

https://www.eaton.com/content/eaton/us/en-us/company/policies-and-statements/privacy-cookies-and-data-protection.html.html

Case study 4: Siemens

Siemens is implementing a uniform data protection solution for MindSphere worldwide, which was developed in accordance with the standards of the General Data Protection Regulation (GDPR). With MindSphere Data Privacy Terms, every customer is offered the conclusion of contractual clauses that give them full control over the content with personal data processed on MindSphere. This includes transparency of all sub-service providers used with access to personal data and audit rights in order to be able to check compliance with contractual promises and data protection requirements. The MindSphere Data Privacy Terms apply worldwide and thus enable compliance with European data protection law as well as local data protection requirements in other jurisdictions.

Further information

https://www.plm.automation.siemens.com/media/global/en/Siemens_MindSphere_Whitepaper_tcm27-9395.pdf

2. Enabling fair access to data

In principle, each generator of data should be able to decide how to handle the data it generates. ZVEI rejects the monopolization of data and the creation of new legislation for data ownership rights. Access to and use of data should be organized between partners freely and in fair contracts that take the interests of both sides into account in an appropriate manner. This ensures that customers and business partners can determine and control which data is accessed and for what purpose it is used..

Case studies from practice

Case study 1: Bundesdruckerei

Bundesdruckerei offers itself as a trusted partner to facilitate the exchange of data between organisations. This is because if organisations do not fully trust each other when exchanging data or if direct data exchange is not technically or legally possible, this can prevent the development of data-driven business models. As a trusted partner of both organizations, the data trustee intervenes in between. The original data is transferred to the data custodian and analysed and processed according to the agreed data governance. Only the result is passed on to the authorised organisation.

Further information

https://www.bundesdruckerei.de/de/Themen-Trends/Magazin/Der-Datentreuhaender-als-neutrale-Schutzinstanz

Case study 2: Osram

Osram has established the Lightelligence software platform, which enables cloud-based collection and analysis of a wide range of data from various sources. Only the respective customers themselves have control over their data. A granular, transparent authorization concept ensures that data is not released to third parties unintentionally. In addition, it is possible to give the applications of third parties only those rights that are necessary for their function. There is a strict separation between individual customers, which is verified by various technical measures and tested regularly. Osram does not access or use customer data for its own purposes.

Further information

https://www.lightelligence.io/

3. Promoting data security through security by design and security lifecycle management

Basic requirements for the sharing and use of data are: Access that is protected against misuse; secure processing, storage and handling of data; and the maintenance of its integrity and confidentiality. Companies in the electrical industry are therefore committed to promote security as comprehensively as possible through a holistic approach. This includes both security by design in the development phase and security lifecycle management throughout the entire product and data lifecycle.

Unauthorized access must be countered with the fastest possible response.

Case studies from practice

Case study 1: Befund24

Befund24 has set up a marketplace for the mediation of remote diagnosis services in the health sector. To protect personal data, the platform operates according to the basic principle of „privacy by design and by default“ in accordance with Article 25 of the General Data Protection Regulation (GDPR). The development of the Befund24 marketplace solution is based on the Siemens Healthi- neers cybersecurity development process, which includes a threat and risk analysis (TRA), the imple- mentation of security standards and security checks. In addition, external penetration tests are car- ried out regularly. Patient data is always encrypted in the Befund24 cloud. Patients can assert any claims for information against the hospital or the creator of the findings report.

Further Information

https://www.befund24.de/

Case study 2: Eaton

At Eaton, every digitally controlled or networked product or system is tested by a global Center of Excellence (CoE) for product cybersecurity as part of the cybersecurity life-cycle before being launched to the market. The CoE, together with the product managers, acts as an approval body.

Further information

https://www.eaton.com/us/en-us/markets/innovation-stories/Managing-Cybersecurity-Risks.html

Case study 3: Infineon

The high safety requirements for automated and networked vehicles have a major influence on the design of Infineon chips as the smallest electronic elements in the vehicle. In modern vehicles with 100 or more ECUs, so-called security anchors protect against manipulation or theft of data. These semiconductor chips with highly secure encryption mechanisms are either directly integrated into the numerous microcontrollers or built in as discrete security controllers. These chips protect against manipulation and intrusion attempts, so that a violation of data security can be fended off.

Further information

https://www.infineon.com/cms/de/discoveries/Fahrzeugsicherheit/?redirId=38066

Case study 4: Phoenix Contact

Phoenix Contact takes security requirements for software and hardware into account as early as the development phase of a product. For automation solutions, a security concept with the necessary protective measures is developed. Both are carried out in accordance with the international IEC 62443 series of standards. Phoenix Contact has also established a team as a contact partner for users who discover security gaps and actively informs them about known safety gaps. The Product Security Incident Response Team (PSIRT) adheres to the process chain of the standard series when processing, evaluating and publishing reports and updates.

Further information

https://www.phoenixcontact.com/online/portal/pc/pxc/offcontext/insite_landing_page/!ut/p/z1/xZRRb4IwFIV_DY

Case study 5: Siemens

Siemens has established ten principles for cyber security in its "Charter of Trust". These include the principle of "Taking Responsibility in the Digital Supply Chain". This means, for example, that security must also be anchored in the value network with suppliers. To ensure this, a roll-out was started, which includes corresponding terms and conditions in all purchasing contracts and the qualification of 300 pilot suppliers. Siemens supports business partners and suppliers in implementing the "Roadmap to Compliance" with the necessary security levels, including external certification.

Further information

www.charter-of-trust.com

4. Turning data into information - This added value is an economically significant asset of companies

5. Supporting the portability and interoperability of data used for competitive purposes

The companies in Germany's electrical industry actively promote competition. The ability to use data across different generation and application contexts in parallel can be achieved by supporting data portability through interoperable data formats and information models based on freely accessible standards. In this way, data exchange or data pooling between different providers is possible, thus promoting competition.

Case studies from practice

Case study 1: ABB

ABB supports the development of the Asset Administration Shell concept and incorporates it into its own device and platform developments. The Asset Administration Shell allows data and services from IIoT devices to be connected via a unified interface, regardless of the device manufacturer. In addi- tion, device properties can be exchanged across manufacturers in a standardized way using eCl@ss.

Further information

https://www.youtube.com/watch?v=AXQ0yIonNxk&t=1s

Case study 2: Infineon

In 2018, Infineon launched a so-called Trusted Platform Module (TPM) specifically for automotive applications. The external communication of a vehicle is protected by the TPM - a kind of vault - which generates, stores, distributes and manages cryptographic keys, for example. The TPM complies with international standards (ISO/IEC 11889) and thus contributes significantly to the portability and interoperability of data.

Further information

https://www.infineon.com/cms/en/product/security-smart-card-solutions/optiga-embedded-security-solutions/optiga-tpm/sli-9670/

Case study 3: Siemens

Siemens MindSphere offers open, bi-directional communication at every interface and can be integ- rated with applications, machines, enterprise IT systems and other IT platforms. Customers also have the option of designing the data models according to their own wishes or removing data from the backend. With IDL (Integrated Data Lake) and EDI (Enterprise Data Interconnect), Siemens also offers a methodology for using data from other data lakes for MindSphere applications without changing their storage location.

Further information

https://www.plm.automation.siemens.com/media/global/en/Siemens_MindSphere_Whitepaper_tcm27-9395.pdf

6. Promoting the sustainable use of data

7. Enhancing open innovation and co-creation

8. Enable participation in digital platform

Industrial platforms should provide non-discriminatory access to all interested parties. Quality stan- dards or technological prerequisites may have to be defined to ensure security and functionality of the platform (for example by the certification of components); however, these must not be unilateral at the expense of individual market participants.

Case studies from practice

Case study 1: Bundesdruckerei

In future, Bundesdruckerei will offer data trustee services in the healthcare sector (pseudonymisation, authorisation and consent management) as a service via a digital platform. With the help of a trusted third party, personal data and pseudonyms can be managed securely. Only pseudonyms are assigned to the user data. By means of an authorization management the data provider can decide who recei- ves which data for inspection or revoke this authorization.

Further information

https://www.bundesdruckerei.de/de/Themen-Trends/Magazin/Der-Datentreuhaender-als-neutrale-Schutzinstanz

Case study 2: Protiq

Protiq offers an open platform for 3D printing. The digital business model of the manufacturer of 3D printing in plastic, ceramics and metal involves the customer configuring, ordering and paying online. Protiq also operates an open portal where various service providers can offer their 3D printing services. On the marketplace, the customer is free to choose which service provider should complete his order.

Further information

https://www.protiq.com/en/protiqmarketplace/

Case study 3: Siemens

Third-party vendors are enabled to develop their own data-based business models through non-pro- prietary access to the Siemens MindSphere platform. For this purpose, third-party providers can use open interfaces and flexible connectivity solutions for machines (cross-vendor and with any protocols or communication standards) as well as for various software systems (e.g. ERP, MES):

In addition, the MindSphere Store will provide third parties with a secure distribution platform for industrial applications and digital services.

Further information

https://www.plm.automation.siemens.com/media/global/en/Siemens_MindSphere_Whitepaper_tcm27-9395.pdf

9. Promoting transparent operation of digital platforms

10. Enabling fair competition between digital platforms

Die Leitlinien als PDF herunterladen

Zurück zur Übersicht

Industrie Energie Mobilität Gesundheit Gebäude Nachhaltigkeit & Umwelt Leitfaden Digitalisierung Cybersicherheit Daten und Plattformen All Electric Society Mitgliederservice Elektrifizierung